rule MAL_ELF_Specter_Jul_2021_1 {
   meta:
        description = "Detect the Specter malware"
        author = "Arkbird_SOLG"
        reference1 = "https://twitter.com/ESETresearch/status/1410864779229548546"
        reference2 = "https://twitter.com/JAMESWT_MHT/status/1410870749473148930"
        date = "2021-07-02"
        hash1 = "0bff46518b35ddfe37f4a7820286aab829d81f1480d9eeca5aaedc9ceda6724f"
        hash2 = "be97d7ae3b2d876f027d99d8d61dbca92513f4975336c2ebc26cf8a0839b67b6"
        tlp = "White"
        adversary = "Specter"
    strings:
        $s1 = { 41 57 41 89 cf 41 56 4d 89 c6 41 55 41 89 f5 be 01 00 00 00 41 54 49 89 fc bf 02 00 00 00 55 89 d5 31 d2 53 48 83 ec 38 48 c7 44 24 20 00 00 00 00 48 c7 44 24 28 00 00 00 00 e8 cf bf fe ff be 03 00 00 00 89 c3 89 c7 31 c0 e8 1f c4 fe ff 80 cc 08 be 04 00 00 00 89 df 89 c2 31 c0 e8 0c c4 fe ff 48 8d 74 24 20 89 ea 89 df 66 c1 ca 08 66 89 54 24 22 ba 10 00 00 00 66 c7 44 24 20 02 00 44 89 e8 31 ed 0f c8 89 44 24 24 e8 ae be fe ff 85 c0 0f 84 c5 00 00 00 e8 11 c0 fe ff 83 38 73 48 89 c5 74 07 89 df e8 12 b8 fe ff 8b 6d 00 83 fd 73 0f 85 a5 00 00 00 bf 1c 00 00 00 e8 dc b9 fe ff 48 85 c0 48 89 c2 0f 84 8c 00 00 00 44 89 68 14 89 58 18 4d 8d 6c 24 60 44 89 78 10 41 0f 10 06 4c 89 ef 4d 8d 74 24 50 0f 11 02 0f 29 04 24 48 89 04 24 e8 74 c2 fe ff bf 18 00 00 00 e8 b2 b5 07 00 48 85 c0 74 17 48 8b 14 24 48 c7 00 00 00 00 00 48 c7 40 08 00 00 00 00 48 89 50 10 4c 89 f6 48 89 c7 e8 9b fe 08 00 4c 89 ef e8 0b c3 fe ff 41 8b bc 24 88 00 00 00 48 8d 4c 24 14 89 da be 01 00 00 00 89 5c 24 18 c7 44 24 14 1d 20 00 80 e8 26 bd fe }
        $s2 = { 55 31 c0 b9 5d 00 00 00 53 48 89 fb 48 81 ec 48 01 00 00 48 8d 7c 24 4e f3 aa 48 8d 7c 24 4e e8 d2 03 00 00 48 8d bc 24 ab 00 00 00 31 c0 b9 07 00 00 00 48 8d 74 24 28 c7 44 24 30 00 00 00 00 48 c7 44 24 38 00 00 00 00 f3 ab 48 8b 84 24 70 01 00 00 48 8d 7c 24 4e 48 89 44 24 40 48 8d 44 24 30 48 89 44 24 28 e8 36 08 00 00 8b 6c 24 30 85 ed 0f 85 89 00 00 00 48 8b 44 24 40 48 8b 00 48 8b 40 e8 48 39 44 24 38 75 76 48 8d bc 24 c7 00 00 00 31 c0 b9 5d 00 00 00 f3 aa 48 8d bc 24 c7 00 00 00 e8 4d 03 00 00 48 8d bc 24 24 01 00 00 b9 07 00 00 00 89 e8 48 8d 94 24 c7 00 00 00 48 8d 74 24 4e f3 ab 48 8d 7b 18 e8 64 26 00 00 b9 08 00 00 00 48 89 e7 48 8d b4 24 60 01 00 00 f3 a5 48 8d b4 24 c7 00 00 00 89 c2 48 89 df e8 6e fb ff ff 48 8d bc 24 c7 00 00 00 e8 e3 03 00 00 48 8d 7c 24 4e e8 d9 03 00 00 48 81 c4 }
        $s3 = { 83 fa 03 0f 86 e6 00 00 00 41 57 41 56 41 55 41 54 49 89 cc 55 48 89 fd 53 48 89 f3 48 83 ec 28 66 8b 46 04 44 8b 76 0c 44 8b 3e 66 89 44 24 0c 66 8b 46 06 45 8d 6e 01 44 89 7c 24 08 44 89 74 24 14 66 89 44 24 0e 8b 46 08 4c 89 ef 89 44 24 10 e8 f4 b3 fe ff 48 89 c2 48 89 44 24 18 4c 89 e9 31 c0 48 89 d7 48 8d 73 10 f3 aa 48 89 d7 4c 89 f1 f3 a4 44 89 fe 48 89 ef e8 9b fa ff ff ff c0 74 07 4c 89 e1 31 d2 eb 4b 66 83 7c 24 0e 03 75 21 48 8b 74 24 18 48 8d 54 24 10 48 89 ef e8 d4 f8 ff ff 84 c0 75 0b e8 ad b9 fe ff 8b 00 85 c0 75 18 0f b7 54 24 0c 8b 4c 24 08 4d 89 e0 8b 74 24 10 48 89 ef e8 e1 f8 ff ff 83 f8 73 74 11 4c 89 e1 89 c2 8b 74 24 08 48 89 ef e8 ff fe ff ff 48 83 }
        $s4 = { 48 8d 05 5a 5f 0b 00 48 89 84 24 80 00 00 00 48 8b 05 cf 75 30 00 be 18 00 00 00 bf 01 00 00 00 ff 10 48 85 c0 48 89 84 24 98 00 00 00 0f 84 fa fc ff ff 4c 8d bc 24 98 00 00 00 48 8b 54 24 60 48 8d 35 00 2b 0b 00 31 c0 4c 89 ff e8 2c ef ff ff 85 c0 0f 85 f4 fb ff ff 49 8b b5 f8 0d 00 00 48 85 f6 0f 84 13 09 00 00 31 ed 41 0f b7 86 ac 03 00 00 66 25 20 40 66 83 f8 20 0f 84 03 09 00 00 80 7c 24 78 00 0f 84 01 07 00 00 49 8b 8e 18 02 00 00 49 8b 96 10 02 00 00 4c 8d 46 06 48 8d 35 a6 2a 0b 00 4c 89 ff 31 c0 e8 ce ee ff ff 85 c0 0f 85 96 fb ff ff 41 0f b7 86 ac 03 00 00 4c 8d 25 42 eb 0a 00 66 25 20 40 66 83 f8 20 0f 84 55 0b 00 00 49 83 bd f8 0e 00 00 00 48 8d 05 25 eb 0a 00 74 0e 49 8b 96 30 04 00 00 48 85 d2 48 0f 45 c2 49 8b 95 68 0c 00 00 48 8d 35 07 eb 0a 00 48 85 d2 74 13 80 3a 00 74 0e 49 8b 96 18 04 00 00 48 85 d2 48 0f 45 f2 49 8b 96 50 04 00 00 48 8d 0d e1 ea 0a 00 48 85 d2 48 0f 44 d1 49 89 d3 48 8b 54 24 50 48 8b 52 20 48 85 d2 48 0f 44 d1 49 89 d2 49 8b 95 50 0d 00 00 48 85 d2 74 13 80 3a 00 74 0e 49 8b 96 10 04 00 00 48 85 d2 48 0f 45 ca 41 f6 85 85 15 00 00 02 48 8d 2d 96 ea 0a 00 74 0e 49 8b 96 28 04 00 00 48 85 d2 48 0f 45 ea 49 8b be 20 04 00 00 48 8d 15 78 ea 0a 00 4d 8b 8e 08 04 00 00 4d 8b 86 38 04 00 00 48 89 4c 24 10 48 8b 8c 24 80 00 00 00 48 89 74 24 28 48 8d 35 f6 23 0b 00 48 85 ff 4c 89 5c 24 20 4c 89 54 24 18 48 0f 44 fa 4d 85 c9 48 89 44 24 30 48 89 7c 24 60 48 8b 7c 24 70 4c 0f 44 ca 4d 85 c0 48 89 6c }
        $s5 = { 8b 44 24 50 4d 85 ff 4c 89 38 0f 85 12 f8 ff ff e9 dc f9 ff ff 0f 1f 84 00 00 00 00 00 49 83 bd 68 0c 00 00 00 0f 84 bb f7 ff ff 48 8b 05 e3 6f 30 00 49 8b be 18 04 00 00 ff 10 49 8b b5 68 0c 00 00 48 8d 3d ae 26 0b 00 31 c0 49 c7 86 18 04 00 00 00 00 00 00 e8 22 9b 00 00 48 85 c0 49 89 86 18 04 00 00 0f 85 96 f7 ff ff e9 1d f9 ff ff 0f 1f 44 00 00 41 80 bd ea 0e 00 00 00 48 8d 05 01 26 0b 00 48 89 44 24 60 0f 88 2f f6 ff ff 83 fb 07 0f 87 2a 01 00 00 48 8d 05 76 28 0b 00 89 da 48 63 14 90 48 01 d0 ff e0 0f 1f 00 4c 8b 7c 24 50 49 8b 3f e8 e3 fa fe ff 85 c0 0f 85 eb f7 ff ff 49 8b 3f e8 f3 fa fe ff 49 89 47 08 e9 1e f9 ff ff 66 2e 0f 1f 84 00 00 00 00 00 49 8b b6 d0 00 00 00 49 8b bd f0 10 00 00 e8 5d cf 00 00 85 c0 0f 85 91 f9 ff ff 49 8b 86 d8 03 00 00 45 8b 86 98 01 00 00 8b 80 80 00 00 00 a8 02 74 0d 41 81 f8 bb 01 00 00 0f 84 b9 01 00 00 a8 01 74 0a 41 83 f8 50 0f 84 ab 01 00 00 41 0f b6 86 ad 03 00 00 48 8d 0d 2e e7 0a 00 48 8d 15 8a 1c 0b 00 48 8d 3d de 25 0b 00 48 89 ce 83 e0 02 48 8d 05 3c 07 0b 00 48 0f 45 ca 48 8b 54 24 58 48 0f 45 f0 31 c0 e8 14 9a 00 00 49 89 86 38 04 00 00 48 85 c0 0f 85 99 f9 ff ff e9 0f f8 ff ff 48 8d 05 05 25 0b 00 48 89 44 24 60 e9 2f f5 ff ff 48 8d 05 ef 24 0b 00 48 89 44 24 60 e9 1e f5 ff ff 48 8d 05 56 cd 0a 00 48 89 44 24 60 e9 0d f5 ff ff 48 8d 05 d6 24 0b 00 48 89 44 24 60 e9 fc f4 ff ff 48 8d 05 0e d1 0a 00 48 89 44 24 60 e9 eb f4 ff ff 66 2e 0f 1f 84 00 00 00 00 00 49 8b 86 d0 03 00 00 f6 80 80 00 00 00 03 74 28 8d 43 fd 83 f8 01 0f 86 6a 02 00 00 41 f6 85 eb 0e 00 00 01 74 12 49 83 bd f8 14 00 00 ff 0f 84 62 02 00 00 0f 1f 40 00 41 80 a5 68 06 00 00 bf 48 8d 05 44 e6 0a 00 41 f6 85 68 06 00 00 40 48 89 c1 48 8d 05 60 24 0b 00 48 0f 44 c1 48 89 44 24 70 e9 01 f8 ff ff 66 0f 1f 84 00 00 00 00 00 83 7f 18 04 4c 8d 3d f3 0a 0b 00 }
    condition:
        uint32(0) == 0x464c457f and filesize > 100KB and 4 of ($s*) 
}
